request objects should have iat and exp

[Joseph Heenan]

There doesn't seem to be anything in FAPI part 2 that requires request objects to have iat and exp fields.

I believe this would allow an attacker to replay authorisation requests much later on. I'm not sure that's desirable.

Should we be mandating iat & exp?

[Vladimir Dzhuvinov]

@Nat It may also make sense to discuss potential replay risks in the upstream JAR spec:

https://tools.ietf.org/html/draft-ietf-oauth-jwsreq-16

[Nat Sakimura]

Aug 1 callers felt that exp should be enforced. iat should be allowed.

[Nat Sakimura]

Torsten to create a pull request. * shall for exp;

[Torsten Lodderstedt]

please review pull request

[Nat Sakimura]

Fixes #152. Merged in 152-request-objects-should-have-iat-and-exp (pull request #62)

Financial_API_WD_002.md edited online with Bitbucket

→ <<cset 1e334d6bc786>>

[Nat Sakimura]

Merged in josephheenan/fapi/avoid-clause-renumbering (pull request #66) to fix #162 and fix #152.

Explicitly disallowed client_secret_jwt (#162) + update fix for #152 so that the spec clauses aren't renumbered

Approved-by: Nat Sakimura [e-mail]

→ <<cset 1d66ccb37423>>